Security best practices

Store in environment variables

Use UNIFYUNITS_API_KEY. Never hardcode keys in source control.

Never in URLs

Always send keys in the Authorization header only.

Separate keys per environment

An account has one active key, so use a separate account for each environment that needs its own key (for example staging). Never reuse a production key in development.

Rotating a key

Rotating revokes the old key immediately (allow up to 60 seconds for every edge location to catch up). Update your secret store and redeploy right after rotating, and watch for INVALID_API_KEY responses.

CORS & browser clients

Public discovery routes allow any origin. Authenticated conversion routes only allow origins listed in the deployment ALLOWED_ORIGINS setting. CORS is not a security boundary.